OpenClaw CVE-2026-42435: Shell Wrapper Vulnerability Allows Environment Variable Injection

The National Vulnerability Database has detailed CVE-2026-42435, a high-severity vulnerability (CVSS 8.8) affecting OpenClaw versions from 2026.2.22 before 2026.4.12. This flaw stems from insufficient shell-wrapper detection, enabling attackers to inject environment variable assignments at the argv level. This isn’t just a minor bypass; it allows manipulation of critical shell variables like SHELLOPTS and PS4.

Attackers can exploit this to bypass exec preflight handling, fundamentally altering execution semantics and undermining security controls. The impact is significant: high confidentiality, integrity, and availability risk. This type of injection can lead to arbitrary code execution or privilege escalation if an attacker can control the input to an affected OpenClaw instance.

Defenders need to recognize that this isn’t about a bug in a specific application feature, but a weakness in how OpenClaw interacts with the underlying shell environment. This class of vulnerability is particularly dangerous because it subverts core system functions, making traditional application-level security controls less effective. Patching is critical, but also understanding the broader implications for systems that rely on robust shell execution integrity.